CVE-2023-37914: Privilege escalation (PR)/RCE from account through Invitation subject/message
Impact Any user who can view Invitation.WebHome can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This can be reproduced with the following steps:
1. Open the invitation application (Invitation.WebHome). 1. Set the subject to {{cache}}{{groovy}}new File("/tmp/exploit.txt").withWriter { out -> out.println("Attacked from invitation!"); }{{/groovy}}{{/cache}} 1. Click "Preview"
Patches The vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6.
Workarounds The vulnerability can be patched manually by applying the patch on Invitation.InvitationCommon and Invitation.InvitationConfig.
References - https://jira.xwiki.org/browse/XWIKI-20421 - https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view Invitation.WebHome can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6. Users are advised to upgrade. Users unable to upgrade may manually apply the patch on Invitation.InvitationCommon and Invitation.InvitationConfig, but there are otherwise no known workarounds for this vulnerability.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-37914?
CVE-2023-37914 is a vulnerability in XWiki Platform that allows any user who can view 'Invitation.WebHome' to execute arbitrary script macros and gain remote code execution access.
How severe is CVE-2023-37914?
CVE-2023-37914 has a severity rating of 9.9 (critical).
Which versions of XWiki Platform are affected by CVE-2023-37914?
Versions 2.5 to 14.4.8 and 14.5.0 to 14.10.6 of XWiki Platform are affected by CVE-2023-37914.
How can the CVE-2023-37914 vulnerability be exploited?
The CVE-2023-37914 vulnerability can be exploited by executing arbitrary script macros, including Groovy and Python macros, in the 'Invitation.WebHome' page.
What is the remedy for CVE-2023-37914?
The recommended remedy for CVE-2023-37914 is to upgrade to version 15.2-rc-1 of 'org.xwiki.platform:xwiki-platform-invitation-ui' package.